Ireland: Data Protection Commissioner loses in Supreme Court over GR

On 3 July 2013 the Irish Supreme Court gave its judgment in the appeal by the Irish Data Protection Commissioner ("DPC") in EMI Records (Ireland) Limited & ors v The Data Protection Commissioner [2013] IESC 34. Although this represents an endorsement of the voluntary graduated response scheme agreed between ISP Eircom and the record labels, the decision was based essentially on technical grounds. It offers an interesting example, however, of the attitude of an authority charged with enforcing data protection laws.

As described in an earlier post, EMI and other record labels had sued Eircom for participating in the infringement of copyright by its Internet access subscribers. The case was settled by a contractual GR scheme, under which an infringing user would on his third notification be suspended from Internet access for one week; after a fourth notification, Eircom would terminate his access agreement. The user was free to find another ISP if he could.

The DPC had taken the position that the conventional process of gathering anonymous data and its transmission and processing by Eircom was in some way an infringement of the rights of internet users under data protection law. The parties to the original action took the matter back to court to get a ruling on the issue, but the DPC refused to take part in it. He had asked the parties to pay his costs, win or lose, or at least not claim costs against him, which the parties had declined to agree. Nonetheless, Charleton J gave a judgment on the issue, robustly holding that there was no valid data protection objection to the GR scheme. 

Nothing daunted, the DPC issued an enforcement notice against Eircom under the Data Protection Acts 1988-2003, ordering it to stop operating the scheme. Eircom sought to appeal using the statutory procedure and the labels sought to be joined in that appeal. In an impressive display of fairmindedness, the DPC opposed their joinder, demanding in any event that the labels agree that they would receive no costs if allowed to take part. The labels, who had no automatic right to participate in the appeal, applied for judicial review of the enforcement notice, alleging that the DPC was wrong in law and, in any case, had failed to state any reasons in his notice (a requirement under the Data Protection Acts).

On 27 June 2012 Charleton J ruled on the judicial review application ([2012] IEHC 264), holding that the enforcement notice was bad in law, confirming his earlier analysis that peer-to-peer enforcement involved no breach of privacy, and held that the notice was bad in any event for lack of reasons.

The Supreme Court has now confirmed his decision, affirming that the lack of reasons was fatal. Given this procedural point, however, the court does not reach the substance of data protection law, beyond saying, en passant: 

"it appears to be accepted that the method by which the Protocol works is that all Eircom does is to receive a series of IP addresses from the record companies, write the appropriate letter to the customer corresponding with that IP address, and invoke the suspension or termination provisions of the Protocol as appropriate. On that basis it is not inherently obvious as to why such activity necessarily involves a breach of data protection law." 

No doubt the DPC will return to the fray in due course. 

UK: Regulation of the press – judicial review in prospect?

The Leveson Inquiry into the culture, practice and ethics of the press was announced in July 2011 and concluded its first part with the publication of Lord Justice Leveson’s Report in November 2012. Although the recommendations of the Report raised controversy, there seemed little doubt but that some fairly radical strengthening was likely in the control of the news media. After so much time, it is reasonable to ask: where are we?

It is ironic that so far the only concrete change in press regulation has been the passing of the Defamation Act 2013, which makes it easier for newspapers to escape liability for libel. However, it does seem as if we are edging towards a new settlement in regulation of the press which will benefit from greater independence from industry and be sustained by more substantial enforcement powers. The intrusion of the law, however tentatively, into this field is likely to produce administrative law challenges to the regime. In this post I want to summarise the proposals and speculate briefly about what may subsequently happen in the administrative court.

On 18 March 2013, Prime Minister David Cameron announced agreement between the political parties as to the way forward, which involved the creation of a body to oversee self-regulation by the press. A draft Royal Charter was published by the Government, which, if approved by the Privy Council, would create a body corporate, the Recognition Panel, the job of which will be to approve and review the performance of self-regulatory “Regulators”. The Recognition Panel exercises what is explicitly a public function (clause 4.4 of the Charter) and is clearly susceptible of judicial review. It approves or withdraws approval of Regulators by reference to “recognition criteria” set out in Schedule 3 of the Charter.

These criteria include the Regulator’s independence (no current newspaper editors or MPs need apply to serve on the board of a Regulator) and the terms of its “standards code”, which must take into account freedom of speech, the interests of the public, the need of journalists to protect confidential sources and the “rights of individuals” (such as rights to privacy). There is no reference to the need to have regard to the commercial interests of subscribers (save in so far as that impliedly enters into the requirement of proportionality).

The Regulator shall have authority to pursue issues on its own initiative and subscribers (i.e., newspapers and online news services) must be required to cooperate with any such investigation. The Regulator must have power to impose a fine of up to 1% of turnover, up to a maximum of £1m, and to require corrections and apologies. It must create a “ring-fenced enforcement fund”. It must also establish an arbitration scheme to resolve civil claims by aggrieved persons against subscribers.

In the meantime, on 25 April 2013 a group of press trade associations published an alternative draft Royal Charter and submitted it to the Privy Council for approval. Although this has delayed the presentation of the Government’s proposal to the Privy Council (originally intended for the Privy Council meeting of 15 May 2013), it seems unlikely that it will prevent the eventual approval of the Government’s draft.

But why would a publisher sign up with a Regulator under any such self-regulatory scheme? The Crime and Courts Act 2013, which received Royal Assent on 25 April 2013, provides certain negative and positive incentives.

By sections 34 to 39, a publisher who is not a subscriber to a recognised Regulator may be held liable for damages which are exemplary (i.e., punitive) or aggravated (i.e., compensating for the hurtfulness of the wrong) in a claim for libel, slander, breach of confidence, misuse of private information, malicious falsehood or harassment, where that claim is “related to the publication of news-related material”. These provisions come into force one year after the establishment of the Recognition Panel (or some equivalent body under Royal Charter).

However, where the claim could have been dealt with through the Regulator’s arbitration scheme, irrespective of the outcome the publisher who is a subscriber to a Regulator will not normally be ordered to pay the costs of a claim of this sort; but must normally be ordered to pay the costs where he could have been a subscriber and was not, and the claim could have been arbitrated under the Regulator’s arbitration scheme (section 40).

One can foresee judicial review challenges at various levels:

• To the Privy Council, as to its decision to approve the draft charter proposed by the Government (as opposed to the rival charter of the industry) - cf ECHR Art. 10/EU Charter Art. 11 (freedom of expression); EU Charter Art. 16 (freedom to conduct a business)
• To the Recognition Panel, as to its recognition of or withdrawal of recognition from Regulators (no doubt based on independence/terms of the proposed standards code); and as to the possible removal of members of its own board (by 2/3rds majority of the board)
• To decisions of Regulators (under the Nagle v Feilden [1966] 2 QB 633 principle), as to specific decisions to punish subscribers, for example on grounds of proportionality or procedural fairness (the Regulator will be both prosecutor and judge).

It will also be interesting to see whether the courts discover any friction between the proposed regulation of news web sites and the Audiovisual Media Services Directive 2010/13/EU. In addition to publishers of newspapers or magazines containing news-related material, the Royal Charter scheme would apply to a “website containing news-related material (whether or not related to a newspaper or magazine)”. In relation to television-like services delivered online, Article 4(7) of the Directive requires Member States to “encourage co-regulation and/or self-regulatory regimes at national level”. Such regimes “shall be such that they are broadly accepted by the main stakeholders in the Member States concerned and provide for effective enforcement”.

Given the indications from the press that some publishers will boycott the proposed system, it is likely that the Royal Charter will not be (or ever have been) “broadly accepted by the main stakeholders”. In relation to news web sites falling within both regimes (admittedly a small category), the Directive would offer an argument against the enforceability of the new regime.

One way or another, the administrative court is likely to scrutinize the operation of the new regime before long.